Bugs allowed hackers to dox John Deere tractor owners
vice.com
vice.com
At the time I was working on it they had some extremely arcane authentication process that required round-trip emails, various link clicking and code entering, and all kinds of craziness. Toward the end of my tenure our point of contact finally told us they were moving to OAuth but they had nearly zero documentation on it.
For anyone who isn't knowledgable in the farming space, I'd highly recommend a browse through John Deere's API documentation [0]. Before the agtech gig I hadn't really given it a second though, but modern farms are very high tech operations. Really cool stuff happening in agtech.
[0] https://developer-portal.deere.com/#/myjohndeere/api-invento...
I wouldn't say "modern farms are very high tech operations", I'd say "high tech industrial players are in the process of taking over western agriculture".
The word "farm" mean something special to me, as I was born and raised on one. What your talking about is something completely different.
Hell, Lethbridge is home to at least one successful agtech biz, if not more. They're flying drones to analyze weed cover and optimize spraying based on positional data.
It can be very high tech. I don't know what you're saying that it doesn't exist. It's happening in canada literally right now.
That said a lot of these are for medium to large operations. Despite high tech, farmers who farm smaller plots generally have better yield. The automation has basically just let business expand into larger operations they might not otherwise have manpower or expertise to cover.
I think OP might mean that these "high tech farms" are less like farms and more like movie studios. The tractor makers and the bank are acting like a movie studio. The are running a production in a certain area, with certain high tech equipment, with certain subleases on land for a certain number of years. There is no one driving vision and keeping the flame of what high tech should be. It's more like, "let's get this soy to market in the new way that is 7% cheaper before the other team does." Just a guess on what OP means
Despite the size, the general methods between a smaller and a larger farm are not that different imho. But the amount of tech in a modern tractor was and still is amazing, and at the time the average car was definately not up to par. "automatic" GPS assisted driving, "laser" assisted driving (on harvesters). Beyond that, most of the "management" data was already digital 15 years ago, partly due to compliance requirements. And satellite imagery, soil samples, etc... were at least partly integrated.
And I would still call this a farm! Times change, and clinging to the old times in some nostalgia doesn't help. (I don't want to imply that you do!)
And on a slightly different perspective: I don't think bigger farms necessarily produce worse food, generate more externalities, etc... The processes are much more optimized, and at least I think the potential for better food with less externalities is with bigger farms. Also it is a somewhat bogus comparison: Mostly nobody complains that their car / laptop / smartphone comes from a factory, but for farming there is this strange preference for something of 50-100years past.
It is not specific to farming. Handmade, artisan stuff sells well, even when it is objectively worse. And in general, people are more sympathetic to small businesses than big, faceless corporations. We value the human element I guess.
As for food, we tend to equate big farms with everything bad with current agriculture, even if it doesn't have to do with it: crops bred for yield instead of taste/nutrition, monoculture with pesticides/herbicides, ... It is partly true because small, traditional farms then to focus on quality and ethics/sustainability/... rather than price, because they can't compete on price.
With industrialized products you know they want it cheap, resulting in crap product that didn't need to be crap.
For example once I had to repair my Electrolux fridge, when I opened it up I saw two very nasty things: 1. the holes between parts were all misaligned, to the point it was impossible to insert the screws intended to go in them. 2. it was then glued with a ton of glue spread "randomly" all over the place, it was obviously shoddy.
And the issue I had to fix in that fridge? They used the cheapest "defrost" button they could, one that notoriously got stuck often, so your fridge would stay in "defrost" mode forever and stop working, the solution was disassemble it, force the button back with a screwdriver, assemble it again... every time you used the button.
I'm looking at these cabinets in the stock room and they're crap. No joinery, no screws, just flat pieces of cheap wood glued together. So I go to joke with the woman who works in that department about how cheaply they were constructed. She looked me dead in the eye and told me, oh no, these were the nicest cabinets we sold in the store. Top of the line. They even use extra glue to make them sturdier.
I know a guy who can't go through a drive through without lecturing everyone in the car about how being able to get 400kcal for a buck and a half is an amazing feat of societal progress. But he's old and emigrated from Poland so...
My example may be an outlier but there's plenty of people who are happy to get Chilean produce in January and don't care how much methane their 75/25 beef emitted. HN has the spare cash and brain cycles to care about a lot of things that normal people don't even think about.
I wonder if farmers felt the same way when tractors first started coming onto the scene replacing ox/horses and a plow, or combines, or grain carts, or seed drills, or...
Did you grow up using any of that at-the-time "high tech" equipment? It was high tech at some point, now just common tech. At what point is something considered "high tech?" If you were born in the age of cell phones, are they considered high tech, or just common tech you can find on any street corner like gumball machines? If you were born in the 1950's, does your opinion differ on cell phones from someone currently in their 20's who grew up with it and knew no other way?
Technology fueled the Agricultural Revolution. https://www.thoughtco.com/agricultural-revolution-1991931
The farmer would have slammed the door, and fed his horses.
mostly, though, the nature of labor has completely and utterly changed in 80 years and comparing the two is like apples and oranges.
for tractors generally, maybe, but have read many things specifically about john deere being very DRM/anti repair, and a quick google seems to highlight that there are court battles being fought over exactly this right now.
https://www.bloomberg.com/news/features/2020-03-05/farmers-f...
The picture of a hard-working solo farmer repairing his only tractor out in the barn is becoming a rare thing. When you say "farmer" today, it is unclear if you mean the multi-billion dollar multi-national, the "manager" for this 400-acre parcel, or the lady next to the field operating the drone or mostly-autonomous equipment. Or perhaps you meant the latest breed--that fellow who greases the conveyor belt in the metal building in the middle of town where they do the vertical farming with the fancy lights and watering systems. No tractors or even dirt involved.
“High tech industrial players are in the process of taking over western forgery.”
"Modern blacksmiths sure are big!"
Blacksmith:Farmer::Forge:Farm
I mean, someone will always make stock, but fewer companies melt metal these days, or at the very least relative to those that carve it up or weld it together (which may or may not involve a little melting, given spin welding and other techniques).
A forge is closer to what you would call a manufacturing factory:
https://en.m.wikipedia.org/wiki/Forging
A foundry smelts. But it is also technically a factory for input material. In the same way a sawmill is a factory.
From a pre-industrial blacksmith's perspective, the bigger distinction might be between a "factory" and a "shop". The processes involved are effectively the same; the difference is the scale/flexibility tradeoff (a shop can make different things every day without added overhead, where a "factory" gains enormous efficiency by being configured to do a single process).
Lots of tech for data and tracking
I don't know if I agree with you. These kind of agtech farms tend to get heavy on pesticides use and tillage, which on the long term kills the ground life.
And it leaves the farmers' hands tied when a bug happens : https://www.vice.com/en/article/xykkkd/why-american-farmers-...
Meanwhile they are also the biggest levers if appropriately motivated (whether by extra legal or legal incentives) to use better solutions.
* John Deere didn't hire anyone for a Software Engineering job unless they were a licensed engineer, at least in the area that I worked in. This meant a lot of EE and CE majors were writing the software and they pretty much all viewed software dev as "a foot in the door" to do the hardware work to which they aspired. This may not have been true across the company (perhaps only in the area that I worked in) and it may not be true today.
* This also manifest in a culture that was utterly divorced from the rest of the software industry. They're just moving from subversion to git, much of their "CI/CD pipeline" was built with windows .bat scripts and code generation via excel files that take hours to run (I shit thee not). They build pretty much everything in-house from hardware to embedded operating systems, and their embedded codebases are littered with #ifdefs to conditionally compile different code snippets based on the specific model of tractor/comine/sprayer/etc and feature set that it is to be loaded onto. It's hard to put into writing how difficult this is to maintain.
* They build everything in-house, but it's a big company and people just email around binaries for various development tools with no way to find the source code or even the author except to ask around. Submitting a patch to a dev tool is an enormous effort. Word is they're moving to GitHub, and I think it's going to be a game changer for developers.
* Other than that, there's a long tail of other problems. IT seems to have management paranoid that if developers are too productive the hackers will steal their IP and the company will go under or something. So getting a server provisioned is a months-long affair and teams will occasionally just run a Jenkins server from a former coworker's desktop that IT forgot to pick up. There's a culture of "don't try to improve things that aren't immediately in your purview". They routinely pick tools that are abysmal to work with--I don't mean "everyone has different preferences", I mean "they bought SharePoint and made everyone use it, but didn't pay for the SharePoint consultants who program the software to be actually usable within an organization (I'm generously assuming that it's possible to make SharePoint usable--I'm not sure this is the case).
All of that said, John Deere has some really cool problems that would be really fun to work on if not for all of their organizational issues. They had self driving tech years before anyone else, they have a vast array of vehicles that run these distributed networks of embedded controllers, they make their own hardware and software (which could be a lot of fun to work on if managed properly), they aspire to use ag data to improve yields and have a credible path forward (as opposed to the "step 1: use big data, step 2: profit!" sense). Additionally, I think they probably are innovative and well-run in many non-software respects, but I'm not qualified to comment.
Similarly, for all of its issues (including hostility toward folks who want to repair their vehicles), I really want them to turn a corner and succeed because agtech is really cool and they're an American Icon with a (increasingly tarnished) reputation for quality, innovation, and providing quality jobs. I wish them the best and maybe one day I'll apply and try and help from within.
That's just a hacker being an asshole.
> There is no evidence that hackers exploited these flaws. The researcher, who goes by Sick Codes, reported them to John Deere on April 12 and 13...
Seems like they didn't think that people would enter someone else's VIN. A few years back I discovered that I could get activation code for a map update in my car simply by entering my VIN and the product number of the DVDs with the map update.
They gave me a list to choose from when I enterd my VIN, but that didn't stop me from asking for a different product -- and they gladly sent me an email with the matching code.
PS: I'm also from Norway. I see that's a thing now.
The difference is that these are usually an extremely basic (and ultimately pointless) authentication test, not a way to download PII.
There was a lawsuit in Norway a while back were the question essentially was: are you breaking the law if you change the URL? (no, it wasn't). More specifically, a guy logged into Norways DMV and looked up information about his own car and by changing the license plate in the URL he got information about other cars, including their owner. I guess the triggering factor was that he scraped this information into a big database.
In Norway you can freely look up car information based on license plate, but it cost extra (?) to get the name of the owner. So the information wasn't secret in any way.
But that brings us back to the question: where does the line go when scraping the web for information?
They're only slightly controversial here in the Midwestern US. Somewhat like Harley Davidson motorcycles, their users are highly brand loyal due more to historical factors than a modern quality or value comparison. Their owners can be derided for overpaying for underperforming tractors that can only be repaired by a dealer for exorbitant fees, the smart money is buying Kubota or Agco now. Though like a Honda rider in a biker bar, you want to be careful where you say that.
Another question: are Norwegians overrepresented here on HN? I've been wondering this for a while but I'm unsure if it is that or of I just happen to notice everyone who in any way signal that they are Norwegians.
(Yes, I live in Norway to.)
1. Northern Europeans tend to speak excellent English. Flawless English is the norm, anyway much better than people from my native countries.
2. Northern Europeans tend to have excellent technical skills compared to the world average.
While both points help y’alls participation in HN, I think point 1 is the most important of the two. I rarely encounter comments from native Japanese or Koreans, even though their populations are much larger than Norway’s. Typically the commenters have since moved to the US. I do, however, encounter non-IT ppl on HN that are very curious (and typically have interesting backstories). I especially enjoy the occasional comments from diesel mechanics.
But you also have a strong observational bias. While the probability of seeing a Ferrari isnt too low the P of seeing two Ferrari’s next to each other is very low... unless you happen to be driving one of the two Ferraris. Add to that that a car lover (ie Norwegian) is much more likely to notice the Ferrari (other Norwegians).
Care to clue in someone whose cultivation experience terminates at a roto-tiller---
Goddamnit. Nevermind. Just clicked. Well played.
Disclaimer: Not in any associated/involved with John Deere.
While I understand JD has been ahead of other tractor manufacturers (electric, autonomous), the industry hasn't been anywhere close to on pace with the research investments made in these areas where the consumer auto industry has actually been pushing the frontier in research investment in these spaces for some time now - seems more like riding the wave than contributing to "frontier pushing" from their comparative R&D investment in these areas.
That's not even to mention that it's not out of the imagination or even common experience to have a sitcom-tier office workplace where "interesting (to management)" teams are over-resourced while teams in charge of features that are less "interesting" but similarly important to user experience are under-resourced, seemingly in this case infosec. It's a common pattern of a company that may have lost sight of the customer, and in this case they exposed customer data.
Disclaimer: not related to JD, competitors, or research mentioned in this post, but have experience with JD tractors and them being years behind on engineering but years ahead on right-to-repair advocacy.
Long story short they’re def not tech savvy